1 /*
2 * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
3 *
4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree.
9 */
10
11 #include <algorithm>
12
13 #include "modules/rtp_rtcp/include/flexfec_receiver.h"
14 #include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
15 #include "modules/rtp_rtcp/source/byte_io.h"
16 #include "modules/rtp_rtcp/source/rtp_packet_received.h"
17
18 namespace webrtc {
19
20 namespace {
21 class DummyCallback : public RecoveredPacketReceiver {
OnRecoveredPacket(const uint8_t * packet,size_t length)22 void OnRecoveredPacket(const uint8_t* packet, size_t length) override {}
23 };
24 } // namespace
25
FuzzOneInput(const uint8_t * data,size_t size)26 void FuzzOneInput(const uint8_t* data, size_t size) {
27 constexpr size_t kMinDataNeeded = 12;
28 if (size < kMinDataNeeded || size > 2000) {
29 return;
30 }
31
32 uint32_t flexfec_ssrc;
33 memcpy(&flexfec_ssrc, data + 0, 4);
34 uint16_t flexfec_seq_num;
35 memcpy(&flexfec_seq_num, data + 4, 2);
36 uint32_t media_ssrc;
37 memcpy(&media_ssrc, data + 6, 4);
38 uint16_t media_seq_num;
39 memcpy(&media_seq_num, data + 10, 2);
40
41 DummyCallback callback;
42 FlexfecReceiver receiver(flexfec_ssrc, media_ssrc, &callback);
43
44 std::unique_ptr<uint8_t[]> packet;
45 size_t packet_length;
46 size_t i = kMinDataNeeded;
47 while (i < size) {
48 packet_length = kRtpHeaderSize + data[i++];
49 packet = std::unique_ptr<uint8_t[]>(new uint8_t[packet_length]);
50 if (i + packet_length >= size) {
51 break;
52 }
53 memcpy(packet.get(), data + i, packet_length);
54 i += packet_length;
55 if (i < size && data[i++] % 2 == 0) {
56 // Simulate FlexFEC packet.
57 ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, flexfec_seq_num++);
58 ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, flexfec_ssrc);
59 } else {
60 // Simulate media packet.
61 ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, media_seq_num++);
62 ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, media_ssrc);
63 }
64 RtpPacketReceived parsed_packet;
65 if (parsed_packet.Parse(packet.get(), packet_length)) {
66 receiver.OnRtpPacket(parsed_packet);
67 }
68 }
69 }
70
71 } // namespace webrtc
72